CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.6

Red Hat OpenShift Service Mesh 3.3.6 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.3....

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.14

Red Hat OpenShift Service Mesh 3.0.14 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RockyLinux 9 : firefox (RLSA-2026:47104)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47104 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in th...

PT-2026-67537

Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description Incorrect access control in the DS SetDestPathCmd function allows attackers to access sensitive components through path traversal, a technique used to access files or directories outside the intended folder b...

openSUSE 16: openssh / openssh-askpass-gnome / openssh-cavs / openssh-clients / etc (openSUSE-SU-2026:21477-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21477-1 advisory. - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled serve...

Malicious code in @sw-commons-components/message-upsell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee504d58bc907a09044cba70345cf7bc8cf2266c20833ce8bae2866b205208c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @fuji-web-components/maps is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-11438 Malicious code in @fuji-web-components/maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5e567a52783d2e684e1da23e3d5804652801f44f643834fcb30cea6bbab732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11452 Malicious code in @sw-commons-components/message-upsell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee504d58bc907a09044cba70345cf7bc8cf2266c20833ce8bae2866b205208c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fuji-web-components/maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5e567a52783d2e684e1da23e3d5804652801f44f643834fcb30cea6bbab732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-62324 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-62324 Source advisory: OSV:GHSA-J839-GQQ4-GF9J...

UBUNTU-CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

SUSE CVE-2026-34940

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript function in internal/modelcontroller/engineollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components ref, modelParam. This shell command is executed via bash ...

JLSEC-2026-1051

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of...

JLSEC-2026-1009 ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been...